Credential Theft Campaign Targeting Legacy Protocols Blocked by Conditional Access

Initial Signal

Between February 22-25, 2026, Microsoft Entra Identity Protection flagged the account user_1@[INTERNAL_DOMAIN_1].com with 218 high-severity alerts. The signal: 35 failed sign-in attempts originating from 23 unique IP addresses spanning 15 countries—Morocco, Colombia, Finland, France, UK, US, Belgium, Sweden, Jamaica, Netherlands, India, Japan, Venezuela, Armenia, Mexico, and Luxembourg. The attack pattern was methodical. Twenty-eight of the 35 attempts targeted legacy authentication via ROPC (Resource Owner Password Credentials) and Authenticated SMTP against Office 365 Exchange Online—protocols that bypass modern MFA controls. Microsoft Entra Identity Protection categorized the threats as 91 password spray alerts, 91 unfamiliar sign-in property detections, 29 anonymous IP flags, 18 atypical travel alerts, and 5 malicious IP identifications. The investigation spanned 3m 46s of autonomous analysis across Microsoft Entra ID Sign-in Logs, Identity Protection risk detections, and authentication method configurations. Despite the account's critical vulnerability—no MFA registration, password-only authentication—conditional access policies with error code 53003 successfully blocked every unauthorized attempt. All legitimate activity originated from [SITE_1] corporate networks using managed devices.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified geographic distribution of authentication attempts across 15 countries including Morocco, Colombia, Finland, France, UK, US, Belgium, Sweden, Jamaica, Netherlands, India, Japan, Venezuela, Armenia, Mexico, and Luxembourg
   Pass
2. fp2
   Analyzed authentication protocols used in the attack attempts
   Pass
3. fp3
   Evaluated Microsoft Entra Identity Protection risk assessments
   Pass
4. fp4
   Compared legitimate user activity patterns with suspicious authentication attempts
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Credential Compromise at high confidence rests on the following mutually corroborating signals:

1. Thirty-five failed authentication attempts from 23 geographically dispersed IP addresses across 15 countries within a 72-hour window, with 28 targeting legacy ROPC protocol via Exchange Online—a pattern consistent with credential stuffing or password spraying

2. Microsoft Entra Identity Protection's independent risk classification: 218 alerts including 91 password spray detections, 91 unfamiliar sign-in property alerts, 29 anonymous IP flags, and 5 malicious IP identifications, all marking the account as atRisk with high risk level

3. Conditional access policies successfully blocked all unauthorized attempts using error code 53003, preventing actual account compromise despite the attacker possessing or attempting valid credentials

4. Complete absence of successful sign-ins from suspicious locations or with anomalous patterns; all legitimate activity originated from [SITE_1] corporate networks using compliant managed devices

5. No post-authentication malicious activity detected—no data exfiltration, privilege escalation, or lateral movement—confirming the attack was contained before account takeover. Confidence is High rather than Confirmed because the account's lack of MFA registration and the absence of post-compromise telemetry leave a narrow gap: we cannot definitively rule out that the attacker obtained valid credentials, only that they failed to use them successfully before detection and blocking occurred

Lessons

1. 01
   Legacy protocols are attack highways you cannot defend. This investigation shows 28 of 35 attack attempts (80%) targeted ROPC and Authenticated SMTP—legacy authentication methods that bypass MFA entirely. The attacker chose these protocols deliberately because they work around modern security controls. Conditional access policies blocked the attacks, but only because they were configured to do so. The lesson: disable legacy authentication protocols in your tenant unless there is an explicit business requirement. If you must support them, require step-up authentication and IP restrictions. In this case, disabling ROPC for Exchange Online would have stopped the attack at the protocol level.
2. 02
   MFA absence is a critical vulnerability, not a minor gap. The user_1 account had zero MFA methods registered. The 218 alerts from Entra Identity Protection and the conditional access block were the only things standing between the attacker and account takeover. If conditional access had been misconfigured or if the attacker had used a trusted IP range, the account would have been compromised. Mandate MFA for all users, especially those with access to email or sensitive data. The cost of enrollment is negligible compared to the risk of a compromised account.
3. 03
   Geographic dispersion across 15 countries in 72 hours is not a false positive. The investigation correctly ruled out false positive scenarios by noting the 15-country spread, the use of anonymization services, and the targeting of legacy protocols. However, this pattern is also a strong indicator that the attacker had access to a credential database or was running a large-scale password spray campaign. The presence of 5 malicious IPs among the 23 sources confirms this was not a single attacker but a coordinated campaign. Alert on any account seeing authentication from more than 5 countries in 24 hours; it is almost never legitimate business travel.
4. 04
   Conditional access policies work, but only if you configure them correctly. Error code 53003 (Access has been blocked by Conditional Access policies) appeared repeatedly in the logs, meaning the policies were doing their job. However, the account remained at high risk because the attacker had the credentials and was actively trying to use them. Conditional access is a control, not a cure. After an attack like this, reset the user's password, enforce MFA enrollment, and review the policies to ensure they are blocking the right traffic. In this case, the policies should have also blocked ROPC entirely, not just required additional conditions.
5. 05
   Legitimate activity patterns are your baseline for detecting the abnormal. All of user_1's legitimate sign-ins came from [SITE_1] corporate networks using managed devices. This clear baseline made it trivial to spot the 35 failed attempts from 23 foreign IPs. Establish and document the normal authentication pattern for each user or role, then alert on deviations. In this investigation, the contrast between the legitimate [SITE_1] activity and the global attack attempts was stark. Use this principle to tune your detection rules: if a user never signs in from outside the US, flag any sign-in from Japan as suspicious.